Good article factual and well presented. The one thing I would add is a bit about threat model. Hiding your web browsing habits from your ISP is vastly different from a political dissident or journalist who needs protection from state sponsored entities. Each group has very different requirements for a VPN.

It’s worth also saying that “VPN” is a pretty generic term. It includes:

traditional private networks where a node network or endpoint is securely connected to a local hub network, using the Internet as a transport layer (think Cisco VPN)

Ad-hoc private bridges where two endpoints have a private connection over a public network (think Tailscale)

Residential proxy services where companies can use consumer IP addresses to exit to the Internet, looking like a consumer instead of a business (think Hola VPN / Bright Data)

Network bridges that obscure the source and destination addresses (TOR and I2P)

And THEN… the one that gets all the airtime on YouTube (and is mostly what’s discussed in this article): exit proxy services where a consumer can exit to the Internet from an address other than the one assigned by their ISP (Mullvad, Nord, WindScribe, etc.)

The annoying thing is that marketing for public VPN services often leans on features of various of these configurations where the specific implementation being sold is actually quite limited.